Overview
overview
3Static
static
3ProxyHunterReload.exe
windows7-x64
3ProxyHunterReload.exe
windows10-2004-x64
3data/adm.html
windows7-x64
3data/adm.html
windows10-2004-x64
3data/c2n.html
windows7-x64
3data/c2n.html
windows10-2004-x64
3data/help_...ay.htm
windows7-x64
3data/help_...ay.htm
windows10-2004-x64
3data/idrive.js
windows7-x64
3data/idrive.js
windows10-2004-x64
3data/intel.html
windows7-x64
3data/intel.html
windows10-2004-x64
3etext/error1.htm
windows7-x64
3etext/error1.htm
windows10-2004-x64
3etext/error2.htm
windows7-x64
3etext/error2.htm
windows10-2004-x64
3etext/error3.htm
windows7-x64
3etext/error3.htm
windows10-2004-x64
3text/error1.htm
windows7-x64
3text/error1.htm
windows10-2004-x64
3text/error2.htm
windows7-x64
3text/error2.htm
windows10-2004-x64
3text/error3.htm
windows7-x64
3text/error3.htm
windows10-2004-x64
3我要补丁网.htm
windows7-x64
3我要补丁网.htm
windows10-2004-x64
3说明.htm
windows7-x64
3说明.htm
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
ProxyHunterReload.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ProxyHunterReload.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
data/adm.html
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
data/adm.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
data/c2n.html
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
data/c2n.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
data/help_spedia_play.htm
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
data/help_spedia_play.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
data/idrive.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
data/idrive.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
data/intel.html
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
data/intel.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
etext/error1.htm
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
etext/error1.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
etext/error2.htm
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
etext/error2.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
etext/error3.htm
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
etext/error3.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
text/error1.htm
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
text/error1.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
text/error2.htm
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
text/error2.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
text/error3.htm
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
text/error3.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
我要补丁网.htm
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
我要补丁网.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
说明.htm
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
说明.htm
Resource
win10v2004-20241007-en
General
-
Target
3c4d7a9c37df14609c8c1fd7299e066d_JaffaCakes118
-
Size
342KB
-
MD5
3c4d7a9c37df14609c8c1fd7299e066d
-
SHA1
cd1cff75d3f4552e96c051246c22c9445f7949b4
-
SHA256
eb74cbe5b9a9a5de5a70ee6ec761f78afda8eeee41c13998d064efc325f92749
-
SHA512
db38fd6fb0e24a0edbb40a196ba095403871829cdd492a3c34193524777a8d248e867453b756fdec42343110501f06cfd246cf59c9bb54b01f1026a4f04ecf3c
-
SSDEEP
6144:qxkjTxej7w6OPva3f7x6QkzqU5Mhmb2LKFJhH817AiiDsuVEexal/JNhtswZ:qxeTYXTOPm96leU5cmCeFjNiioGbxaPn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ProxyHunterReload.exe
Files
-
3c4d7a9c37df14609c8c1fd7299e066d_JaffaCakes118.rar
-
ProxyHunterReload.PoweredByProxyExpert.txt
-
ProxyHunterReload.exe.exe windows:4 windows x86 arch:x86
eacaccbca1c371811d7c09338792170c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getpeername
connect
WSAAsyncGetHostByName
gethostbyname
getsockname
gethostname
gethostbyaddr
inet_addr
closesocket
recvfrom
WSAAsyncSelect
ntohs
inet_ntoa
bind
listen
accept
socket
setsockopt
ioctlsocket
WSAStartup
WSASocketA
send
recv
htons
sendto
htonl
WSASetLastError
WSAGetLastError
WSACancelAsyncRequest
WSACleanup
kernel32
TlsSetValue
EnterCriticalSection
GetProcessVersion
GlobalReAlloc
LocalReAlloc
GetOEMCP
TlsGetValue
GetCPInfo
GetFileTime
GetFileAttributesA
SetErrorMode
FindResourceExA
GetFileSize
LeaveCriticalSection
GetCommandLineA
ExitProcess
RaiseException
HeapFree
HeapAlloc
GetTimeZoneInformation
GetLocalTime
GetACP
CreateThread
ExitThread
TerminateProcess
HeapReAlloc
HeapSize
LCMapStringA
TlsFree
GlobalHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetStartupInfoA
RtlUnwind
DeleteCriticalSection
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateDirectoryA
LoadLibraryA
CreateSemaphoreA
GetLastError
FreeLibrary
CloseHandle
GetCurrentProcessId
lstrlenA
GetVersionExA
GlobalMemoryStatus
UnhandledExceptionFilter
LocalAlloc
GetProfileStringA
Sleep
GetTickCount
GlobalLock
DeleteFileA
GlobalUnlock
GetProcAddress
TlsAlloc
InitializeCriticalSection
WritePrivateProfileStringA
SizeofResource
GlobalFlags
FindNextFileA
GetPrivateProfileStringA
GetPrivateProfileIntA
SuspendThread
GetCurrentThread
CreateEventA
SetEvent
SetThreadPriority
ResumeThread
FileTimeToLocalFileTime
WaitForSingleObject
VirtualProtect
FileTimeToSystemTime
lstrcmpA
GetFullPathNameA
FindFirstFileA
lstrcpynA
GetVolumeInformationA
SetEndOfFile
FindClose
FlushFileBuffers
UnlockFile
LockFile
ReadFile
SetFilePointer
WriteFile
GetEnvironmentStrings
MulDiv
GetCurrentDirectoryA
CreateFileA
DuplicateHandle
InterlockedIncrement
MultiByteToWideChar
InterlockedDecrement
WideCharToMultiByte
LocalFree
GlobalGetAtomNameA
lstrcatA
GetCurrentThreadId
GlobalFindAtomA
lstrcmpiA
GlobalAddAtomA
LockResource
GlobalDeleteAtom
GetModuleHandleA
SetLastError
FindResourceA
LoadResource
lstrcpyA
GlobalAlloc
GlobalFree
GetModuleFileNameA
GetVersion
GetCurrentProcess
GetEnvironmentStringsW
SetCurrentDirectoryA
SetHandleCount
GetSystemTime
LCMapStringW
user32
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
wvsprintfA
GetWindowDC
BeginPaint
EndPaint
GrayStringA
CharUpperA
GetAsyncKeyState
MapDialogRect
ValidateRect
GetMessageA
SetRectEmpty
IsZoomed
DestroyMenu
PostQuitMessage
GetClassNameA
GetSysColorBrush
InflateRect
TabbedTextOutA
DrawTextA
SetRect
GetDCEx
LockWindowUpdate
SetParent
GetScrollPos
SetScrollPos
GetTopWindow
MessageBoxA
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
TrackPopupMenu
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
GetPropA
CallWindowProcA
GetMenuState
GetMessagePos
GetLastActivePopup
GetWindow
SetWindowLongA
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
EndDialog
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
LoadStringA
SetCursor
ShowScrollBar
OffsetRect
GetDC
ReleaseDC
CopyRect
FillRect
EmptyClipboard
SetClipboardData
IsWindowEnabled
GetActiveWindow
SetActiveWindow
GetCursorPos
SetForegroundWindow
DestroyIcon
KillTimer
SetTimer
GetMenuItemCount
GetMenuItemID
IsIconic
DrawIcon
LoadIconA
GetForegroundWindow
GetKeyState
ExitWindowsEx
GetSystemMetrics
RegisterWindowMessageA
IsWindow
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
GetMenu
ModifyMenuA
PtInRect
LoadMenuA
GetSubMenu
AppendMenuA
EnableMenuItem
IsWindowVisible
SetCapture
ReleaseCapture
GetDesktopWindow
ClientToScreen
CheckMenuItem
SendDlgItemMessageA
WindowFromPoint
ScreenToClient
PeekMessageA
TranslateMessage
DispatchMessageA
WaitMessage
MapWindowPoints
GetFocus
SetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
ScrollWindow
BringWindowToTop
InvalidateRect
UpdateWindow
GetMenuCheckMarkDimensions
RemovePropA
SetMenuItemBitmaps
SetScrollInfo
GetClassLongA
SetPropA
GetMessageTime
SetClassLongA
GetClientRect
DestroyCursor
LoadCursorA
PostMessageA
GetParent
LoadBitmapA
GetWindowRect
EnableWindow
SendMessageA
GetNextDlgTabItem
GetWindowLongA
GetSysColor
DefWindowProcA
ShowCaret
HideCaret
DrawFocusRect
UnregisterClassA
CharNextA
IsWindowUnicode
ExcludeUpdateRgn
DefDlgProcA
gdi32
DeleteDC
CreateBitmap
GetClipBox
SetBkColor
SetTextColor
GetObjectA
SetDIBitsToDevice
CreateCompatibleBitmap
PatBlt
CreateCompatibleDC
CreateSolidBrush
BitBlt
CreatePen
SelectObject
SetBkMode
SetMapMode
SetROP2
OffsetViewportOrgEx
SetViewportExtEx
SetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SelectClipRgn
SetWindowExtEx
IntersectClipRect
ExcludeClipRect
LineTo
MoveToEx
RestoreDC
SaveDC
DeleteObject
CreateRectRgn
GetDeviceCaps
CreatePatternBrush
RectVisible
TextOutA
PtVisible
Escape
CreateRectRgnIndirect
ExtTextOutA
GetTextMetricsA
CreateFontIndirectA
GetTextExtentPoint32A
SetRectRgn
CombineRgn
EnumFontFamiliesExA
CreateFontA
GetTextExtentPointA
CreateDIBitmap
GetStockObject
comdlg32
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
OpenProcessToken
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
shell32
Shell_NotifyIconA
ShellExecuteA
comctl32
ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_BeginDrag
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
DestroyPropertySheetPage
CreatePropertySheetPageA
PropertySheetA
Sections
.text Size: 360KB - Virtual size: 359KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 352KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ProxyHunterReload.exe.manifest.xml
-
Uninst.isu
-
config/EXAMPLE.CFG
-
data/adm.html
-
data/c2n.html .js polyglot
-
data/help_spedia_play.htm.js
-
data/idrive.js
-
data/intel.html .js polyglot
-
data/themail
-
etext/error1.htm
-
etext/error2.htm
-
etext/error3.htm
-
etext/page1.txt
-
etext/page2.txt
-
etext/page3.txt
-
etext/page4.txt
-
pprange/DEFAULT.PPC
-
proxyht.cfg
-
result.dat
-
task/ChinaGBN.tsk
-
task/ChinaNet.tsk
-
task/HongKong.tsk
-
text/PAGE1.TXT
-
text/PAGE2.TXT
-
text/PAGE3.TXT
-
text/PAGE4.TXT
-
text/error1.htm
-
text/error2.htm
-
text/error3.htm
-
广告ProxyExpert8免费代理软件的终结者.txt
-
广告ProxyExpert之脱颖而出(8.x系列)全新推出.txt
-
我要补丁网.htm.html
-
我要补丁网软件使用说明www.51patch.com.txt
-
说明.htm.html